سياسة الخصوصية

Privacy policy — English

Updated 1 November 2026. Emdad Order processes account and contact information, organization roles, orders, invoices, payments and support records to operate its pharmaceutical business platform. Files you upload support account and order workflows. Device location may be used for delivery and tracking when you grant permission and use those features.

Data is used for authentication, account verification, order fulfillment, collection, service messages, support and abuse prevention. Relevant business participants see records according to their roles and permissions. Infrastructure providers include Contabo and Cloudflare for hosting, storage and email; processing may take place outside your country. Account documents and attachments are not made public.

Platform offers and interaction records

We record interactions with supplier offers within the platform, such as views and clicks, together with account and offer identifiers to measure offer performance and operate the service. The app does not contain external advertising-network ads. Action logs also support account security and operational auditing.

Optional mobile push notifications

When you enable push notifications in a supported app version and allow them in device settings, we use Google Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service (APNs) to send alerts. A device registration token, opaque account and notification identifiers, and the notification type route the message to the appropriate device and account. These identifiers do not contain your name or email address. The alert contains generic text; order or payment details are fetched inside the app after sign-in and account authorization. You can turn off app notifications in your account preferences or change notification permission in your phone settings. The account preference and operating-system permission are separate controls.

Maps and place search

Supported app versions display maps through Mapbox. Map requests reach Mapbox with your IP address, app information and the map area being viewed. We disable optional telemetry in the app configuration. Search text and map-center coordinates are sent to Emdad servers to rank results from a Yemen OpenStreetMap index; we do not send search text to Mapbox. Organization address points or delivery data are saved when you use the related feature. Opening external directions passes the destination to your chosen maps app, whose own privacy policy applies. The public geographic search dataset is licensed under ODbL and is kept separate from account and order data.

Access controls, encrypted connections and backups protect the service. You can update your profile and notification preferences and revoke device permissions. Business records needed for ongoing transactions and applicable obligations may be retained; backups follow the service retention cycle.

To request deletion, visit account deletion. We verify account ownership before processing a request. Some invoice and transaction records may need to be retained for applicable obligations or unresolved transactions. Contact [email protected].

Scope, contact and data sources

This policy covers Emdad Order mobile apps, emdadorder.com, the business portal and administration service. Emdad Order is a B2B intermediary serving Yemen, not a patient healthcare service. Contact the Emdad Order service team through the website or [email protected] for privacy matters. Download availability abroad does not extend supply or delivery services beyond Yemen. Data comes from you, your organization administrators, transaction participants and service use. Technical records include IP addresses, device/app information, request times, session identifiers, errors and security events. Device/browser storage supports sign-in, language and necessary preferences. We do not sell personal data or use external ad networks or advertising identifiers for cross-app tracking.

Delivery location and user-selected files

Location data includes organization address points and a delivery representative’s precise position during a task they start. When sharing is enabled, positions are sent to our servers and made available to authorized participants in that task. This may continue in the background during the task; Android displays a delivery-service notification. Tracking stops when the task is stopped or completed or location permission is withdrawn. Other features do not require delivery tracking. Do not track another person without their knowledge and authorization. You select uploaded images and documents, including business verification and delivery/payment evidence. The service does not request your contacts, audio recordings or SMS messages. Do not submit patient records, personal prescriptions, passwords or complete payment-card details. Support and company-mail features process message text, sender/recipient addresses and attachments with mailbox and role-based access.

Providers and necessary disclosures

Hosting, storage, email, notification and map providers receive data for the functions described here, subject to relevant service terms and protection arrangements. Customer data must not be used for purposes incompatible with this policy. Necessary disclosures may also occur in response to valid legal requests, fraud prevention or protection of rights. A change of service operator involving a data transfer will be communicated with its implications and applicable rights.

Retention, deletion and control

Account data is kept while the account is active, and operational records for service, security and transaction resolution needs. After a verified deletion request, we delete or anonymize personal data that has no legitimate retention need. Limited records may be kept for legal obligations, disputes or fraud prevention, with use restricted to that purpose. Account deactivation alone is not deletion. Isolated backups expire through rotation: database settings retain two full backup chains locally and four offsite; their age depends on successful scheduled backups. We do not promise immediate erasure from every backup.

You may request access, correction, deletion or object to particular processing by contacting support. After verifying ownership, we explain the action and any justified exceptions. Never send passwords. Withdraw optional device permissions and change notification preferences at any time; the related feature may become unavailable. Withdrawal does not undo prior processing or outstanding business obligations.

Age, security and changes

This professional service is for authorized business users aged 18 and over, not children. Tell us if a child’s data was provided by mistake. We use encrypted transport, access controls, credential protection and backups, but cannot guarantee zero risk. Report suspected unauthorized access to support. Changes carry an updated date; material changes receive clear notice and additional consent is requested before new data uses when required.